d27dd0ffbb
Close 12 audit-driven platform-compliance gaps on a single branch. - D4 dispatch: app/integrations/dispatch_client.py participant `legacyhub`, emits LegacyhubDocumentIndexed + AssetDerivativeReady after the indexing commit (idempotent uuid5), http_inbox route (reindex/tombstone) with audit-based dedupe; docs/dispatch-contract.md. Celery+Redis stays intra-module. - D2 SSO: app/integrations/identity.py validates X-TeamHub-* + role/scope mapper; security.py adds trusted-header enforcement (AUTH_REQUIRE_IDENTITY) and a scope check on /search; docker-compose.teamhub.yml (external teamhub_net + internal db net, api not host-published); RUNBOOK network/firewall section. - Asset standard: SearchHit/Citation carry asset_id/owner_module; buckets renamed teamhub-legacyhub-* (+quarantine/tmp/exports); purge-by-asset_id with legal-hold guard (app/indexing/projection.py); OCR-markdown derivative event. - audit_log model + Alembic 0003 + record_audit on writes (same transaction). - Secret masking: app/common/json_logger.py recursive mask wired into structlog (+ensure_ascii=False); event payloads redacted before persistence. - Service X-API-Key mandatory on ingest endpoints (defence-in-depth). - Port: host API 8000->8050 (collision with SalesHUB/MailHUB resolved), container still listens on 8000. - Config: no plaintext secret defaults; fail-loud in non-dev (no value leak). - Docs drift: README PG 5440, layered-auth note, 5173 removed from CORS; ingest/folder gated by ENABLE_FOLDER_INGEST (410 by default). - ADRs: layers mapping, shared-core extraction, UI locale (RU-first). Tests: 78 passing (ruff, compileall, pytest, tsc, vite build, compose config). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
52 lines
1.7 KiB
Python
52 lines
1.7 KiB
Python
"""Tests for secret-handling config validation."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from app.config import Settings, _enforce_secret_policy
|
|
|
|
_SECRET_ENVS = ("POSTGRES_PASSWORD", "MINIO_ACCESS_KEY", "MINIO_SECRET_KEY")
|
|
|
|
|
|
def _clear_secrets(monkeypatch):
|
|
for key in _SECRET_ENVS:
|
|
monkeypatch.delenv(key, raising=False)
|
|
|
|
|
|
def test_dev_allows_empty_secrets(monkeypatch):
|
|
monkeypatch.setenv("APP_ENV", "dev")
|
|
_clear_secrets(monkeypatch)
|
|
settings = _enforce_secret_policy(Settings(_env_file=None))
|
|
assert settings.app_env == "dev"
|
|
assert settings.postgres_password == ""
|
|
|
|
|
|
def test_prod_requires_secrets(monkeypatch):
|
|
monkeypatch.setenv("APP_ENV", "prod")
|
|
_clear_secrets(monkeypatch)
|
|
with pytest.raises(RuntimeError):
|
|
_enforce_secret_policy(Settings(_env_file=None))
|
|
|
|
|
|
def test_prod_ok_when_secrets_present(monkeypatch):
|
|
monkeypatch.setenv("APP_ENV", "prod")
|
|
monkeypatch.setenv("POSTGRES_PASSWORD", "p")
|
|
monkeypatch.setenv("MINIO_ACCESS_KEY", "a")
|
|
monkeypatch.setenv("MINIO_SECRET_KEY", "s")
|
|
settings = _enforce_secret_policy(Settings(_env_file=None))
|
|
assert settings.app_env == "prod"
|
|
|
|
|
|
def test_prod_error_names_keys_but_never_values(monkeypatch):
|
|
monkeypatch.setenv("APP_ENV", "prod")
|
|
monkeypatch.setenv("POSTGRES_PASSWORD", "super-secret-value")
|
|
monkeypatch.delenv("MINIO_ACCESS_KEY", raising=False)
|
|
monkeypatch.delenv("MINIO_SECRET_KEY", raising=False)
|
|
with pytest.raises(RuntimeError) as exc:
|
|
_enforce_secret_policy(Settings(_env_file=None))
|
|
msg = str(exc.value)
|
|
assert "MINIO_ACCESS_KEY" in msg
|
|
assert "MINIO_SECRET_KEY" in msg
|
|
assert "super-secret-value" not in msg
|